csrf option default value workaround so templates are happy